skuld | 2024-11-02_67e6682f007be61b2b7e18886920ff2c_ngrbot_poet-rat_snatch | Triage

Sharing

General

Target

2024-11-02_67e6682f007be61b2b7e18886920ff2c_ngrbot_poet-rat_snatch
Size

9.9MB
MD5

67e6682f007be61b2b7e18886920ff2c
SHA1

f68caf9bd030538bc9f56044a0691fbe17288a38
SHA256

dfed4f6cdeb962152ce1530cce291ca9bfce75af9211525b7f305d1ad96abaf1
SHA512

707dc3a85b1a0000502ad5632abe9f1f198e310ee524d8c46c104017331db9781868db092cb31df8ce56a442a9f93045f17e445b7666af72452823b7a457ed44
SSDEEP

98304:IsX622siFe05tPY+6OJv2IRHuiY5zf7ElB2v/Zmtz2:Iu6NFe0zfsIRHu15zfoGcz2

Score

10^/10

skuld

Malware Config

Signatures

Skuld family
skuld

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-11-02_67e6682f007be61b2b7e18886920ff2c_ngrbot_poet-rat_snatch

Files

2024-11-02_67e6682f007be61b2b7e18886920ff2c_ngrbot_poet-rat_snatch
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 468KB - Virtual size: 798KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ